OfficeEaze Privacy Policy

Last updated: June 2026 Version 3.0 Governed by the laws of the Province of Ontario, Canada.

1. Our Commitment

Lou Squared Systems Inc., operating as OfficeEaze ("OfficeEaze", "we", "us"), respects your privacy and is committed to protecting your personal information in accordance with Canada's Personal Information Protection and Electronic Documents Act ("PIPEDA") and applicable provincial privacy legislation. In British Columbia and Alberta, the provincial Personal Information Protection Act (PIPA) also applies to personal information handled in those provinces; residents there may contact their provincial Information and Privacy Commissioner in addition to the federal Office of the Privacy Commissioner of Canada.

We are monitoring federal privacy law reform. Bill C-27, which had proposed the Consumer Privacy Protection Act (CPPA), died on prorogation in January 2025. Its successor, Bill C-36 ("Protecting Privacy and Consumer Data Act"), was tabled in June 2026 but is not yet law. As of the date of this policy, PIPEDA remains the applicable federal private sector privacy law in Canada. If and when replacement legislation comes into force, we will update our practices and this policy accordingly.

Scope of This Policy: OfficeEaze provides services exclusively to employers in Canadian provinces and territories outside Quebec. OfficeEaze does not serve employers in Quebec and this policy does not address obligations under Quebec's Act Respecting the Protection of Personal Information in the Private Sector (Law 25 / Bill 64). OfficeEaze is designed for use in non-unionized, provincially regulated workplaces only. Employers in federally regulated industries (banking, telecommunications, interprovincial transportation, and others under federal jurisdiction) are not the intended users of this Service and use it at their own risk.

OfficeEaze is a trade name of Lou Squared Systems Inc., a corporation incorporated under the Canada Business Corporations Act. References to "OfficeEaze", "we", and "us" in this Privacy Policy refer to Lou Squared Systems Inc.

2. Definitions

For clarity in this policy:

"Personal information" means information about an identifiable individual, as defined under PIPEDA.

"Sensitive personal information" means the subset of personal information that, if disclosed, could cause significant harm — specifically, in the context of OfficeEaze: Social Insurance Numbers, banking and direct deposit details, dates of birth, medical information stored for emergency contact purposes, and biometric clock-in photographs.

"Account holder" or "employer" means the business or individual who creates and controls an OfficeEaze account.

"Employee data" means personal information about an employer's workers that the employer enters into OfficeEaze.

"Service" means the OfficeEaze platform and all associated features.

3. Information We Collect

We collect:

(a) Account information — name, email address, business name, role, job title, and account credentials.

(b) Business information you input — employee records, vendor details, invoices, wages, CRA deadlines, expenses, and scheduling data.

(c) Sensitive personal information you choose to store — Social Insurance Numbers, banking details for direct deposit setup, dates of birth, and medical information for emergency contacts. This information is stored in encrypted form and is never transmitted to any AI model.

(d) Usage data — log files, IP addresses, browser type, pages visited, and feature usage patterns.

(e) Payment information — when you subscribe to OfficeEaze, your payment details (billing name, billing address, and card or banking information) are submitted directly to Helcim Inc., our Canadian payment processor headquartered in Calgary, Alberta. OfficeEaze never receives your card number, CVV, or full banking details. Helcim returns a secure payment token, which is the only payment reference stored in OfficeEaze. Helcim is PCI DSS Level 1 certified — the highest level of payment card industry compliance. Helcim is subject to its own privacy policy available at helcim.com. Payment data processed by Helcim remains in Canada.

(f) Communications — support emails and chat records when you contact us.

(g) Account holder authentication data — the mobile phone number you provide at signup is used for two-factor authentication and account recovery. It is transmitted to Twilio Inc. solely to deliver one-time authentication codes.

(h) Pre-employment screening records — where an employer uses the Background Checks module, OfficeEaze stores candidate name, email address, position applied for, types of checks requested, check status, credit check justification (where applicable), and hiring decisions. Consent records confirming the candidate authorized each check are stored alongside the screening record. This information is entered by and belongs to the employer and is processed by OfficeEaze as data processor on the employer's instructions. Candidates whose information is entered into the Background Checks module are not OfficeEaze users and should direct any privacy inquiries to the employer who initiated the screening.

(i) Clock-in photos — where an employer enables selfie clock-in, photographs of employees captured at clock-in are stored securely in OfficeEaze. These photos are used solely to verify employee attendance and are accessible only to the employer and their authorized managers. Employers are responsible for obtaining employee consent before enabling selfie clock-in. Clock-in photos are retained for 90 days after capture and then permanently deleted unless the employer has flagged the punch for payroll dispute review, in which case the photo is retained for the duration of the dispute plus 1 year.

(j) Client and contact information — employers may store names, email addresses, phone numbers, addresses, and business notes for their own clients, customers, and business contacts using the Client Management module. This information is stored on behalf of the employer as data controller and is used solely to provide the Service. The employer is responsible for ensuring they have a lawful basis under applicable privacy legislation to collect and store this information in OfficeEaze. OfficeEaze does not use client contact information for any purpose other than displaying it to the employer within the Service.

(k) Employee authentication data — employee mobile phone numbers provided for employee portal authentication are transmitted to Twilio Inc. solely for the purpose of delivering one-time authentication codes. Twilio does not receive any other employee personal information. Mobile phone numbers are stored in the employee record and used only for authentication purposes.

4. How We Use Your Information

We use your information to:

(a) Provide, operate, and improve the Service.

(b) Process subscription payments through Helcim.

(c) Send transactional emails — security alerts, remittance reminders, document signing requests, pay stub notifications, and account administration messages.

(d) Send marketing emails and product updates only to users who have provided express consent under CASL.

(e) Respond to support requests.

(f) Comply with legal obligations including CRA requirements and provincial employment standards.

(g) Detect and prevent fraud, abuse, and unauthorized access.

(h) Generate anonymized, aggregated product usage statistics that cannot identify you.

5. Lawful Basis

We process personal information based on:

(a) The contract between us — necessary to provide the Service.

(b) Your express consent — for sensitive personal data and marketing communications.

(c) Our legitimate interests — operating, securing, and improving the Service.

(d) Legal obligations — compliance with tax, employment, and privacy legislation.

6. Data Controller and Data Processor Roles

OfficeEaze operates in two distinct privacy roles:

As a data controller: OfficeEaze controls personal information collected directly from account holders — including name, email address, business name, billing information, and usage data. OfficeEaze determines the purposes and means of processing this information and is responsible for it under PIPEDA.

As a data processor: OfficeEaze processes personal information that employers input about their employees — including Social Insurance Numbers, banking details, dates of birth, wages, and other HR records. In this role, OfficeEaze acts solely on the instructions of the employer. The employer is the data controller for all employee personal information stored in OfficeEaze and is responsible for ensuring they have a lawful basis to collect, store, and process that information.

Employee personal information is never used by OfficeEaze for any purpose other than providing the Service to the employer. OfficeEaze does not contact employees directly regarding their personal data except where required by law or where the employer has specifically authorized a communication (such as a pay stub notification or document signing request).

7. Sharing of Information

We do not sell your personal information. We do not share your information with advertisers. We share information only with the following service providers as necessary to operate the Service:

Lovable Inc. — application hosting and platform infrastructure. Data is hosted on Amazon Web Services Canadian region (ca-central-1, Montreal). SOC 2 Type II and ISO 27001:2022 certified. Compliance documentation available on request — privacy@officeeaze.ca

Amazon Web Services — underlying cloud infrastructure (via Lovable). Canadian region (ca-central-1, Montreal). SOC 2 Type II and ISO 27001 certified.

Supabase, Inc. — application database, authentication, and edge functions (via Lovable). Stores customer records, employee data, documents, and payroll records. Canadian region (ca-central-1, Montreal). SOC 2 Type II certified.

Helcim Inc. — payment processing. Canadian company headquartered in Calgary, Alberta. PCI DSS Level 1 certified. Helcim receives your billing name, billing address, and card or banking details directly from your browser — this data never passes through OfficeEaze servers. OfficeEaze stores only the payment token Helcim returns. Payment data stays in Canada.

Stripe, Inc. — subscription billing and per-invoice payment links. Receives billing details and subscription status; payment details are submitted directly by the payer and OfficeEaze receives only a token, never raw card data. United States. PCI DSS Level 1 certified.

Anthropic PBC — AI processing for the Harris assistant. Company profile context only — no SINs, banking details, dates of birth, employee names, or employee personal information. United States. See Section 8.

ElevenLabs Inc. — voice synthesis for the Harris AI assistant's spoken responses, used only when you interact with Harris by voice. ElevenLabs receives only the text of Harris's spoken responses, converted to speech audio. It never receives Social Insurance Numbers, banking details, dates of birth, employee names, or any sensitive personal information. United States. SOC 2 Type II certified.

HeyGen — animated avatar video streaming for the Harris AI assistant's on-screen visual presence, used only when you interact with Harris by voice. HeyGen receives only the audio stream of Harris's spoken responses in order to animate the on-screen avatar. It never receives business data or sensitive personal information. United States.

Resend Inc. — transactional email delivery, including security alerts, pay stub notifications, document signing requests, welcome emails, trial sequence, payment receipts, and dunning emails. Also handles inbound email processing (receipt forwarding from in.officeeaze.ca and support email intake). Email is sent from a verified OfficeEaze subdomain. United States. SOC 2 Type II certified.

Twilio Inc. — SMS delivery for account holder two-factor authentication, account recovery, and employee portal authentication. United States. ISO 27001 and SOC 2 Type II certified. SMS messages contain only a 6-digit code — no personal information in message content.

Cloudflare Inc. — security infrastructure and DDoS protection. United States. SOC 2 Type II and ISO 27001 certified.

Google LLC — Gmail receipt scanning, used only if you connect a Gmail account. Receives a Gmail OAuth token and the content of receipt emails you choose to import. United States. ISO 27001 and SOC 2 Type II certified.

Microsoft Corporation — Outlook receipt scanning, used only if you connect an Outlook account. Receives an Outlook OAuth token and the content of receipt emails you choose to import. United States. ISO 27001 and SOC 2 Type II certified.

Open Exchange Rates — exchange rate data provider used for non-CAD/USD currency conversions. Invoice total amounts in foreign currencies are transmitted to retrieve current exchange rates. No personal information is transmitted.

Bank of Canada — exchange rate data for CAD/USD conversions. No personal information is transmitted. Canadian federal government service.

Instatus — system status page hosting and uptime monitoring at status.officeeaze.ca. Receives only the public availability status of OfficeEaze services and, for subscribers, the email address used to subscribe to status notifications. No business or employee data is transmitted.

Government authorities when legally required.

A complete and current list of all subprocessors is maintained at officeeaze.ca/subprocessors

OfficeEaze's use of Lovable Inc. is governed by Lovable's Data Processing Agreement, which applies to OfficeEaze's plan and forms part of our agreement with Lovable. Each other processor is subject to contractual data protection obligations. A Data Processing Agreement (DPA v1.4) is available to all OfficeEaze customers. CT and Enterprise customers receive a copy at account activation. Standard plan customers may request a copy at privacy@officeeaze.ca.

8. Harris AI Assistant

When you use the Harris AI assistant, the following information is transmitted to Anthropic's Claude API to generate responses:

What Harris receives: Your company name, province, industry type, employee count, revenue range, certain aggregated financial metrics such as outstanding invoice totals, the current screen or module you are viewing within OfficeEaze, and your business health score summary.

Voice and avatar: Harris is available by text and by voice. When you interact with Harris by voice, the text of Harris's responses is converted to speech audio by ElevenLabs and used to animate an on-screen avatar through HeyGen (see Section 7). Voice processing handles only the words Harris speaks aloud — it never includes sensitive personal information.

Voice interaction transcripts processed through our AI assistant Harris are handled by ElevenLabs Inc. (listed in our subprocessors). Transcripts are retained for a maximum of 90 days and automatically deleted thereafter. Audio is never stored — only real-time transcription is processed. You may request deletion of your interaction history at any time by contacting privacy@officeeaze.ca.

Harris memory: Harris stores the following information in your OfficeEaze account database to provide continuity — document routing patterns (recurring vendor names and filing folder preferences learned over time), payroll notes (per pay period reminders and adjustments you ask Harris to remember, stored per pay period number), and bookkeeping and HR notes (follow-up items you ask Harris to track). Harris memory is stored in your OfficeEaze account, not with Anthropic. It is not used to train AI models. You can view, edit, and delete all Harris memory from Settings → Harris Memory at any time. Harris memory is deleted when your account is deleted.

What Harris never receives: Employee Social Insurance Numbers, banking details, dates of birth, employee names, medical information, payroll amounts, or any other sensitive personal information. This is a technical restriction — Harris was never given access to this data and cannot share what it cannot see.

Anthropic does not use data submitted through the API to train its models. Your conversations with Harris are not used to improve Claude. ElevenLabs and HeyGen do not use voice or avatar data submitted through their APIs to train models.

You may choose not to use Harris at any time, and you may use Harris by text only without engaging the voice or avatar features.

Automated Processing Disclosure: Harris may surface compliance flags, generate document suggestions, highlight payroll anomalies, or provide recommendations based on your business data. These outputs are informational only. No automated decision with legal or significant effect on any individual is made by Harris without human review and approval. The employer remains solely responsible for all final decisions including payroll approvals, HR actions, and compliance filings. Harris is an assistant — not a decision-maker.

Financial Projections Disclosure: Harris may generate cash flow forecasts, budget projections, variance analyses, and other forward-looking financial estimates based on data entered into OfficeEaze. These estimates are informational tools only and are not financial advice. See the Financial Projections section of the Terms of Service for the full disclaimer applicable to financial projections.

9. Data Storage and Cross-Border Considerations

Where your data is stored: Your data is physically stored in the Canadian AWS region (ca-central-1) — a data centre located in Montreal, Quebec. All data is encrypted at rest using AES-256-GCM with separate encryption keys per data category.

Infrastructure: OfficeEaze is hosted on Lovable's platform which runs on Amazon Web Services infrastructure — the same cloud provider used by Canadian banks, the federal government, and major Canadian enterprises. Lovable maintains SOC 2 Type II, ISO 27001:2022, and GDPR certification. Current compliance documentation including penetration test attestation and Transfer Impact Assessment is available on request — contact privacy@officeeaze.ca

CLOUD Act disclosure: Amazon Web Services is an American company subject to US law including the Clarifying Lawful Overseas Use of Data Act (CLOUD Act), which allows US law enforcement to compel American companies to produce data in certain circumstances. This exposure is identical to that faced by virtually every Canadian organization using cloud infrastructure — including major Canadian banks and federal government agencies that also use AWS Canadian regions.

Other service providers: Some service providers — including our AI assistant (Anthropic), voice synthesis (ElevenLabs), avatar streaming (HeyGen), SMS authentication (Twilio), inbound email (Resend), and security infrastructure (Cloudflare) — are based in the United States. These providers handle only the limited data necessary for their specific function. They never receive Social Insurance Numbers, banking details, dates of birth, or medical information in plain text.

Our commitment: We are actively evaluating fully Canadian-owned infrastructure options as they become viable and will update this policy if our data storage arrangements change.

9A. International Data Transfer Consent

By using OfficeEaze, you acknowledge and consent to the processing of limited technical data by service providers located in the United States as described in Sections 7 and 9. This includes the AI assistant (Anthropic), voice synthesis (ElevenLabs), avatar streaming (HeyGen), SMS authentication (Twilio), inbound email (Resend), and security infrastructure (Cloudflare). These providers never receive sensitive personal information in plain text.

If you do not wish to have data processed by United States voice providers, you can use Harris by text only and avoid the voice and avatar features entirely. For any other concerns about cross-border processing, contact privacy@officeeaze.ca.

10. Sensitive Data Protection

Social Insurance Numbers are encrypted using AES-256-GCM with a dedicated encryption key and are never stored in plain text, never included in emails or exports, and never visible in full in the OfficeEaze interface.

Direct deposit banking details are encrypted separately with their own encryption key and are only decrypted server-side when generating direct deposit files.

Dates of birth and medical information are encrypted with category-specific keys.

Access to any encrypted field requires re-authentication and is logged in an immutable audit trail with timestamp and IP address.

Employee clock-in QR tokens are unique identifiers assigned to each employee for use with the kiosk time clock. These tokens are stored in the employee record and are regenerated if an employee is offboarded. QR tokens are not transmitted to any third party and are not used for any purpose other than time clock authentication.

11. Account Security

We protect access to your account through:

Strong password requirements — account passwords must be at least 12 characters and include uppercase, lowercase, a number, and a special character. Passwords are hashed and never stored in plain text.

Two-factor authentication — all employer accounts must verify with a 6-digit code from an authenticator app. Passkey (biometric) sign-in is also supported.

Self-serve account recovery — if you lose access to your authenticator app, you can recover your account by verifying the mobile phone number on file via SMS, after which you are required to set up two-factor authentication again. Password resets also require SMS verification of the phone number on file before a new password can be set.

Session controls — sessions expire after a period of inactivity, active sessions and trusted devices can be reviewed and revoked, and repeated failed authentication attempts trigger a temporary lockout and email alert.

12. Data Retention

> DRAFT — pending legal review. The retention and deletion language in this section reflects OfficeEaze's operational policy but has not yet been reviewed by counsel. Do not treat as final legal wording.

While your account is active. OfficeEaze stores the data you and your team enter for as long as your account is active, so you can run your business. OfficeEaze includes a document-retention flagging feature in your Filing Cabinet: while your account is active, it flags documents that have passed common Canadian retention guidelines (for example, 7 years for CRA financial records, 10 years for workplace-safety records, 4 years after an employee's last day for former-employee HR documents, and permanent retention for corporate records such as articles of incorporation, bylaws, and minutes). This is a convenience reminder only — OfficeEaze never automatically deletes your documents while your account is active; you decide what to delete and when.

After you cancel — we do not retain your records, for any reason. OfficeEaze does not keep a copy of your business records, payroll data, documents, or your employees' personal information after your account closes — including for compliance purposes. Your business records are yours, and you are solely responsible for downloading them before deletion and retaining them to meet your own legal obligations (the CRA requires at least six years for payroll and tax records). After cancellation, your account remains accessible until the end of your billing period, after which your account data is permanently and irreversibly deleted 30 days later. We send reminders at 15, 7, and 1 days before the deletion date, and you may export everything at any time from Settings → Export Your Data before then.

Your employees also lose access on the deletion date. When your account is deleted, every employee on that account loses portal access to their own pay stubs and T4s in OfficeEaze at the same moment. As the employer and data controller, it is your responsibility to give your employees copies of their records before the deletion date. OfficeEaze will not contact your employees directly.

What we keep after deletion. Only: (a) your signed data-deletion acknowledgment; (b) an internal deletion log; and (c) limited billing records OfficeEaze must keep for its own tax and accounting purposes.

Employee personal information — including Social Insurance Numbers, banking details, dates of birth, payroll records, and HR documents — is deleted together with the employer's account data on the same schedule, and is not retained by OfficeEaze afterward. OfficeEaze processes employee data on the employer's instructions as data processor; the employer is the data controller. Former employees should direct any access, correction, or deletion requests to their employer. OfficeEaze cannot restore deleted records for a former employee once the employer's account is deleted.

Individual employee terminations while the account remains active. When an employer offboards an individual employee and the employer's OfficeEaze account remains active, that former employee keeps read-only portal access to their pay stubs and T4s in OfficeEaze for one (1) year after their last day, after which their portal access ends. The employer remains responsible for retaining and distributing employee records for the periods required by law.

13. Children's Privacy

OfficeEaze is a business-to-business service intended for use by adults operating or employed by a business. We do not knowingly collect personal information from individuals under the age of 18 as account holders. If you believe a minor's personal information has been entered into the Service inappropriately, please contact privacy@officeeaze.ca and we will work with the account holder to address the situation promptly.

Note: Provincial employment standards legislation permits the employment of young workers (under 18) in certain circumstances. Where an employer has lawfully hired a young worker and enters that worker's information into OfficeEaze, that data is processed on the employer's instructions as data controller. The employer is responsible for ensuring they have the necessary consents and legal basis to collect and process that young worker's personal information.

14. Your Rights Under PIPEDA

You have the right to:

(a) Know what personal information we hold about you.

(b) Access and obtain a copy of that information.

(c) Correct inaccurate information.

(d) Request deletion of your information subject to legal retention requirements.

(e) Withdraw consent for non-essential processing.

(f) Data portability — export your data at any time from Settings → Export Your Data.

(g) File a complaint with the Office of the Privacy Commissioner of Canada at priv.gc.ca. If you are in British Columbia or Alberta, you may instead complain to your provincial Information and Privacy Commissioner (oipc.bc.ca or oipc.ab.ca).

Employee Rights: If you are an employee whose personal information has been entered into OfficeEaze by your employer, your PIPEDA rights regarding that information should be directed to your employer, who is the data controller for your records. OfficeEaze is a data processor acting on your employer's instructions and cannot independently fulfill access, correction, or deletion requests for employee records without employer authorization. If you believe your employer has mishandled your personal information, you may file a complaint with the Office of the Privacy Commissioner of Canada at priv.gc.ca.

15. CASL — Canada's Anti-Spam Legislation

OfficeEaze complies with Canada's Anti-Spam Legislation (CASL).

Commercial electronic messages — including marketing emails, product updates, and feature announcements — are sent only to users who have provided express consent at account creation.

Transactional messages — including security alerts, pay stub notifications, CRA deadline reminders, document signing requests, and account administration messages — are exempt from CASL consent requirements and are sent regardless of marketing preferences.

Every marketing email includes a one-click unsubscribe link. You can also withdraw consent at any time by emailing hello@officeeaze.ca or updating your notification preferences in Settings.

16. Cookies and Tracking Technologies

We use the following categories of cookies:

Essential cookies — required for the Service to function and cannot be declined: Session authentication cookie, CSRF protection token, and cookie consent record.

Analytics cookies — non-essential and require your consent before loading: Usage analytics to understand which features are used and error monitoring to capture technical issues.

We do not use advertising cookies, tracking pixels, or third-party marketing cookies of any kind.

When you first visit OfficeEaze we ask for your consent before loading any non-essential cookies. You can withdraw consent at any time by clearing your browser cookies or contacting privacy@officeeaze.ca

17. Security Breach Notification

OfficeEaze's obligations as data processor: In the event of a breach of our own security safeguards involving your personal information that creates a real risk of significant harm, we will notify you as soon as feasible and will report to the Office of the Privacy Commissioner of Canada as required by PIPEDA's mandatory breach reporting requirements. We maintain records of all breaches of security safeguards as required by PIPEDA. Notification will describe the nature of the breach, the information affected, and the steps taken to mitigate harm.

Your obligations as data controller: As the data controller for your employees' personal information, you have independent PIPEDA obligations to report breaches and notify affected individuals. OfficeEaze provides a Privacy Breach Incident tool in your Security dashboard to help you document and track your breach response. If a breach involves employee Social Insurance Numbers, banking details, or medical information, real risk of significant harm is likely and OPC notification is required. You should contact your Privacy Officer and the OPC promptly — do not wait to be certain.

Breach record-keeping: PIPEDA requires organizations to keep records of all breaches of security safeguards regardless of whether they create a real risk of significant harm. OfficeEaze's Privacy Breach Incident tool creates and maintains these records automatically when you log a breach.

Report a breach to the OPC: priv.gc.ca/en/report-a-concern/report-a-privacy-breach-as-a-business

Contact our Privacy Officer: privacy@officeeaze.ca — Nadine Leduc, Co-Founder | Chief Legal & Compliance Officer

18. Privacy Impact Assessment and Breach Records

OfficeEaze has conducted a Privacy Impact Assessment (PIA) covering our data flows, third-party processors, cross-border transfers, and security controls. The PIA is available to enterprise customers and regulators on request.

OfficeEaze maintains records of all breaches of security safeguards as required by PIPEDA Section 10.3, including breaches that do not meet the real risk of significant harm threshold. These records are available to the Office of the Privacy Commissioner on request.

Contact privacy@officeeaze.ca for PIA or breach records.

19. Accessibility

OfficeEaze is committed to making this Privacy Policy and our Service accessible. This policy is provided in a screen-reader-friendly format. If you require this policy in an alternative format, contact privacy@officeeaze.ca

20. How to Exercise Your Rights

Contact our Privacy Officer:

Nadine Leduc — Co-Founder | Chief Legal & Compliance Officer privacy@officeeaze.ca

We respond to all verified privacy requests within 30 days as required by PIPEDA.

To file a complaint with a privacy regulator: Office of the Privacy Commissioner of Canada — priv.gc.ca British Columbia: Office of the Information and Privacy Commissioner for BC — oipc.bc.ca Alberta: Office of the Information and Privacy Commissioner of Alberta — oipc.ab.ca

21. Changes to This Policy

We will notify you of material changes to this Privacy Policy by email with at least 14 days notice. Continued use of the Service after the effective date constitutes acceptance of the updated policy.

22. Governing Law

This Privacy Policy is governed by the laws of the Province of Ontario and the federal laws of Canada applicable therein, including the Personal Information Protection and Electronic Documents Act (PIPEDA). Any dispute arising from this policy shall be subject to the exclusive jurisdiction of the courts of Ontario.

23. Contact

Privacy Officer: Nadine Leduc — Co-Founder | Chief Legal & Compliance Officer Email: privacy@officeeaze.ca Mailing address: 18 Joe Taylor Lane, Carbonear, NL A1Y 1A9

CEO and Co-Founder: Jennifer Tsoutouras Email: jennifer@officeeaze.ca

General inquiries: hello@officeeaze.ca Support: support@officeeaze.ca Security concerns: security@officeeaze.ca Legal matters: legal@officeeaze.ca

Lou Squared Systems Inc. (operating as OfficeEaze) Registered office: 158 Day Road, Castleton, ON K0K 1M0